NVD

Id
24308  
Name
CVE-2015-2172  
Description
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-03-30  
Modified Date
2016-12-30  
Seq
2015-2172  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
128668 24308 CVE-2015-2172 http://advisories.mageia.org/MGASA-2015-0093.html  View
128669 24308 CVE-2015-2172 FEDORA-2015-3211  View
128670 24308 CVE-2015-2172 FEDORA-2015-3186  View
128671 24308 CVE-2015-2172 FEDORA-2015-3079  View
128672 24308 CVE-2015-2172 [oss-security] 20150301 Re: CVE request: DokuWiki privilege escalation in RPC API  View
128673 24308 CVE-2015-2172 72827  View
128674 24308 CVE-2015-2172 https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5f  View
128675 24308 CVE-2015-2172 https://github.com/splitbrain/dokuwiki/issues/1056  View
128676 24308 CVE-2015-2172 https://www.dokuwiki.org/changes  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6689 JVNDB-2015-002009 DokuWiki における権限を取得される脆弱性 DokuWiki は、ACL プラグインのパーミッションを適切にチェックしないため、権限を取得され、ACL ルールを追加または削除される脆弱性が存在します。 CVE-2015-2172 79397 CVE-2015-2172 24308 6.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002009.html 2015-02-25 2015-04-02 View